{"id":"CVE-2022-51022","published":"2026-10-22T11:17:05.153","lastModified":"2026-10-22T17:40:46.877","description":"YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef","tags":[]},{"url":"https://github.com/liukuo362573/YiShaAdmin/commit/c3b66e66bf6d70a561190cd8da7f4df7b141931d","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/yishaadmin-lfi.yaml","tags":[]},{"url":"https://huntr.com/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128","tags":[]},{"url":"https://www.vulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-downloadfile-endpoint","tags":[]}],"exploitRefs":[{"url":"https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef","tags":[]},{"url":"https://github.com/liukuo362573/YiShaAdmin/commit/c3b66e66bf6d70a561190cd8da7f4df7b141931d","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/yishaadmin-lfi.yaml","tags":[]}],"hasPoc":true,"ai":{"summary":"The YiShaAdmin application (versions 2.2–3.1) contains a path traversal vulnerability in its /admin/File/DownloadFile endpoint, allowing unauthenticated attackers to read and delete arbitrary files on the server by manipulating the filePath parameter with directory traversal sequences.","exploitability":"Exploitation is trivial for remote attackers as it requires no authentication, user interaction, or special conditions—only a network-accessible endpoint.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality (via reading sensitive files like /etc/passwd) and availability (via deleting critical system or application files), potentially enabling further attacks such as credential theft or service disruption.","remediation":"Upgrade to YiShaAdmin version 3.2 or later, which includes the fix from commit 025b062; if upgrading is not immediately possible, disable or restrict access to the /admin/File/DownloadFile endpoint and remove the delete parameter functionality.","detection":"Defenders should monitor web server access logs for requests to /admin/File/DownloadFile containing path traversal sequences (e.g., ../) in the filePath query parameter, especially when combined with a delete=true parameter; such requests are highly suspicious and likely indicate exploitation attempts.","tags":["path-traversal","unauthenticated","file-read","file-delete","webapp","critical"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:51:45.468Z"}}